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We explore a generalization of quantum secret sharing (QSS) in which classical shares play a 
complementary role to quantum shares, exploring further consequences of an idea first studied by 
Nascimento, Mueller-Quade and Imai (Phys. Rev. A64 042311 (2001)). We examine three ways, 
termed inflation, compression and twin-thresholding, by which the proportion of classical shares can 
be augmented. This has the important application that it reduces quantum (information processing) 
players by replacing them with their classical counterparts, thereby making quantum secret sharing 
\f~^ • considerably easier and less expensive to implement in a practical setting. In compression, a QSS 

' scheme is turned into an equivalent scheme with fewer quantum players, compensated for by suitable 

, classical shares. In inflation, a QSS scheme is enlarged by adding only classical shares and players. 

■ In a twin-threshold scheme, we invoke two separate thresholds for classical and quantum shares 

' based on the idea of information dilution. 
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p\| ' Suppose the president of a bank, Alice, wants to give access to a vault to two vice-presidents. Bob and Charlie, 
, whom she does not entirely trust. Instead of giving the combination to any one of them, she may desire to distribute 
■ the information in such a way that no vice-president alone has any knowledge of the combination, but both of them can 
' jointly determine the combination. Cryptography provides the answer to this question in the form of secret sharing 
In this scheme, some sensitive data is distributed among a number of parties such that certain authorized 
' sets of parties can access the data, but no other combination of players. A particularly symmetric variety of secret 
C^, splitting (sharing) is called a threshold scheme: in a {k,n) classical threshold scheme (CTS), the secret is split up 
' into n pieces (shares), of which any k shares form a set authorized to reconstruct the secret, while any set of fc — 1 or 
^ I fewer shares has no information about the secret. Blakely and Shamir showed that CTS's exist for all values of 
^ I k and n with n> k. By concatenating threshold schemes, one can construct arbitrary access structures, subject onW 
to the condition of monotonicity (ie., sets containing authorized sets should also be authorized) 0- Hillery et al. |g 
• • and Karlsson et al. proposed methods for implementing CTSs that use quantum information to transmit shares 
securely in the presence of eavesdroppers. 

Subsequently, extending the above idea to the quantum case, Cleve, Gottesman and Lo proposed a (fc, n) quantum 
^ ' threshold scheme (QTS) as a method to split up an unknown secret quantum state \S) into n pieces (shares) with the 
5^ , restriction that k > n/2 (for if this inequality were violated, two disjoint sets of players can reconstruct the secret, in 
violation of the quantum no-cloning theorem 0]). The notion of QTS is based on quantum erasure correction [lOl[lll|. 
QSS has been extended beyond QTS to general access structures "j'Ts^, but here the no-cloning theorem implies that 
none of the authorized sets shall be mutually disjoint. Potential applications of QSS include creating joint checking 
accounts containing quantum money Q , or share hard-to-create ancilla states ll^ , or perform secure distributed 
quantum computati on I l5j| . Implementing QSS is well within current technology and has been demonstrated by 
a recent experiment [iTj. 

In conventional QSS schemes, it is often implicitly assumed that all share-holders carry and process quantum 
information. Given the fragile nature of quantum information, this can often be difficult and expensive from a 
practical viewpoint. Fortunately, it turns out to be possible sometimes to construct an equivalent scheme in which 
some share holders carry only classical information and no quantum information, an idea first studied by Nascimeto 
et al. |l8j. Our work is dedicated to exploring further consequences of this idea. It is of considerable importance 
to consider ways in which the proportion of classical shares and classical information processing can be increased in 
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realizing a QSS scheme. Furthermore, hybrid (classical-quantum) QSS can potentially avail of features available to 
classical secret sharing such as share renewal |0, secret sharing with prevention and disenrolment [2ll |. 

In particular, our work is aimed at studying ways to augment the proportion of classical shares in different ways for 
various situations in QSS. As pointed out above, the main purpose of this exercise is to render practical implementation 
easier and less expensive. In Section m we present some basic ways to introduce a classical information component 
into QSS. In Section ITTll wc discuss how this can be used to 'compress' a QSS, that is, reduce the proportion of 
quantum information carrying players. In Section llVI we show how a QSS scheme can be 'inflated' by adding only 
classical shares. In Section we invoke two separate thresholds for classical and quantum shares based on the idea 
of information dilution. This generalizes the idea of conventional single threshold QSS schemes and is again shown to 
lead to savings of quantum players. 

II. HYBRIDIZING QUANTUM SECRET SHARING SCHEMES 

The essential method to hybridize (i.e., to introduce classical shares into) QSS is to somehow incorporate classical 
information that is needed to decrypt or prepare the quantum secret as classical shares. Use of classical shares can 
sometimes obviate and thus lead to savings in quantum shares, or, at any rate, quantum players. A simple instance 
of such classical information is the ordering information of the shares. In QTS, it is implicity assumed that the share- 
holders know the coordinates of the shares in the secret, i.e., they know who is holding the first qubit, who the second 
and so on. This ordering information is necessary to reconstruct the secret, without which successful reconstruction 
of the secret is not guaranteed. If we wish to make use of this ordering information in the above sense, then only 
quantum error correction based secret sharing where lack of ordering information leads to maximal ignorance can be 
used. In particular, the scheme should be sensitive to the interchange of two or more qubits. For example, let us 
consider a (2,3)-QTS. The secret here is an arbitrary qutrit and the encoding maps the secret qutrit to three qutrits 
as: 

a|0) + /3|1) + 7|2) a(|000) + |111) + |222)) + /3(|012) + |120) + |201)) + 7(|021) + |210) + |102)), (1) 

and each qutrit is taken as a share. While from a single share no information can be obtained, two shares, with ordering 
information, suffice to reconstruct the encoded state Q. However, the lack of ordering information does not always 
lead to maximal ignorance about the secret. Note that the structure of the above code is such that any interchange 
of two qubits leaves an encoded |0) intact but interchanges |1) and |2). Thus, a secret like |0) or (l/\/2)(|l) + |2)) can 
be entirely reconstructed without the ordering information. Therefore, only the subset of quantum error correction 
codes admissible in QSS that do not possess such symmetry properties can be used if the scheme is to be sensitive to 
ordering information. 

Another scheme relevant here is due to Nascimento et al. |18|j based on qubit encryption 22]. We adopt this method 
to generate the relevant encrypting classical information. However, in principle any classical data whose suppression 
leads to maximal ignorance of the secret is also good. Elsewhere, in Section we consider another way. Quantum 
encryption works as follows: suppose we have a n-qubit quantum state \4>) and random sequence K of 2n classical bits. 
Each sequential pair of classical bit is associated with a qubit and determines which transformation a € {I, (t^, d'y, az} 
is applied to the respective qubit. If the pair is 00, / is applied, if it is 01, ax is applied, and so on. To one not knowing 
K, the resulting j'i/)) is a complete mixture and no information can be extracted out of it because the encryption leaves 

any pure state in a maximally mixed state, that is: {1/ A){I\S) {S\I + d-x\S) {S\ax + a-y\S) {S\ay + az\S) {S\d-z) = (1/2)/. 
However, with knowledge of K the sequence of operations can be reversed and \tfj) recovered. Therefore, classical 
data can be used to encrypt quantum data. In general, given d dimensional objects, quantum encryption requires 
(fi operators and a key of 2 \og{d) bits per object to randomize perfectly. In practice, such quantum operations may 
prove costly, and only near-perfect security may be sufficient. In this case, there exists a set of roughly dlog{d) unitary 
operators whose average effect on every input pure state is almost perfectly randomizing, so that the size of the key 
can be reduced by about a factor of two (23)| . 

III. COMPRESSING QUANTUM SECRET SHARING SCHEMES 

In hybrid QSS, the quantum secret is split up into quantum and classical shares of information. We call the former 
q-shares, and the latter c-shares. A player holding only c-shares is called a c-player or c-member. Otherwise, she or 
he is a q-player or q-member. 

Definition 1 A QSS scheme realizing an access structure T = {ai, a2, ■ ■ ■ ,Q!r} among a set of players V = 
{Pi,P2, ■ ■ ■ , Pn} is said to he compressible if fewer than n q-players are sufficient to implement it. 
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Here the a^'s are the minimal authorized sets of players. Knowledge of compressibility helps us decide how to minimize 
valuable quantum resources needed for implementing a given QSS scheme. As an example of compression by means 
of hybrid QSS, suppose we want to split a quantum secret \S) among a set of players V — {A, B, C, D, E, F} reahzing 
the access structure F = {ABC, AD, AEF}. That is, the only sets authorized to reconstruct the secret are {A, B, C}, 
{A, D} and {A, E, F} and sets containing them, whilst any other set is unauthorized to do so. For distributing the 
secret, we encrypt \S) using the quantum encryption method (described above) with classical key K into a new state 
\S) and give \S) to A. We then split up K using a CSS scheme that realizes F. Player A cannot recover \S) from 15) 
because he cannot unscramble it without K. Only the a^-'s, and sets containing them, can recover the classical key 
K, and thence decrypt the secret state. In this way, by means of a hybrid (classical-quantum) secret-sharing scheme, 
we can compress the original QSS scheme into an equivalent one in which fewer players need to handle quantum 
information. 

We use the notation of single parantheses (double parantheses) to indicate CTS (QTS). In a conventional ((fc,n)) 
scheme, a compression is known to be possible if 2A: > n + 1, in which case, the scheme can be compressed into 
a ((fc — 7,n — 7)) scheme combined with a {k,n) scheme, where 7 = 2k — n — 1 [T^ . A general access structure 
F = {ai, a2, ■ ■ ■ jQfr} can be realized by a first layer of (1, r)-threshold scheme. In the quantum case, since this 
violates the no-cloning theorem, it is replaced by the majority function ((r, 2r — 1)) scheme ^^l- This, again, is 
incompressible. However, in the second layer of the construction, the ((|ai|, schemes can be replaced with a 

((1, 1)) schemes combined with (|ai|, |ai|) schemes [l8|. 

In the above, the degree of compression is determined by F = {ai,- ■ • ,ar} and the requirement to minimize q- 
players, no matter who they are. This can be distorted if the information processing capabilities of individual players 
are known to be different. In particular, suppose we are given a set Q, such that players from this set are able to 
process quantum information reliably. The set of remaining players Q — V — Q are best designated to be c-players. A 
'hitting set' 7i(F) for the collection of sets F is a set of players such that 7i n 7^ V i (1 < i < r). Let A^(F) be the 
smallest hitting set for F such that A1(F) C Q. A1(F) may or may not be unique. We denote M = |A^(F)|. Under 
compression, only M q-players are needed. First a majority function {{r,2r — 1)) is employed, r of the shares being 
encrypted and deposited with the M q-players. In the second layer of the construction, the ((|ai|, |Q;i|)) schemes can 
be compressed to ((1, 1)) schemes combined with (|Q;i|, |Q;i|) schemes, the q-shares of each ai being deposited with the 
respective q-player. The remaining M — 1 shares are split-shared according to a maximal scheme that contains F. 
The maximal scheme is obtained by adding authorized sets to F until authorized and unauthorized sets form exact 
complements Ijj. Thus we require only M < \V\ q-players to implement the protocol, which represents a compression 
by — M q-players. We note that if A1(F) — 0, then compression is impossible. We can observe that for a general 
access structure involving a large number of players, computing Al is a provably hard problem (In fact its decision 
version can be shown to be NP-Complete 25. ,26j'). 

As an example, let us consider the access structure F = {ABCD, ADF, CDE} among six players V — 
{A,B,C,D,E,F}. Suppose Q = {A,C,E}. We can choose M = {A,C} or M = {A,E}, representing the two 
required q-players (instead of six q-players, required in the uncompressed version). Suppose we choose the latter. 
The first layer will employ a (3, 5)-QTS to split secret \S). At the second layer, the share on the top two rows are 
encrypted using Ki, K2 and given to A, the last using K3 and given to E. The ifj's are classically shared on each row, 
though the q-shares remains with A or E. The last share \S') is shared using a pure state scheme that implements 
Tmax) the maximal scheme obtained from F. The resultant q-shares for each authorized set aj are deposited with 
Uj n A^(F). This scheme is depicted in Eq. 



We note that if D € Q then A^(F) = {D}, and only one q-player, namely D, would have sufficed to implement 
compression. And if Q = {E,F}, then Ai = ^ because there is an authorized set with no q-player. Hence no 
compression would be possible. 



The question, how to augment or "inflate" a given QSS scheme keeping the quantum component fixed, is considered 
herebelow. This is of practical relevance if we wish to expand a given QSS scheme by including new players who do 
not have (reliable) quantum information processing capacity. To this end, we now define an inflatable QSS. 




(4,4) : A,B,C,D 
(3,3) : A,D,F 
(3,3) : C,D,E 



(2) 



IV. INFLATING QUANTUM SECRET SHARING SCHEMES 



Definition 2 A QSS(T ) scheme realizing an access structure F = 



{ai, a2, • ■ ■ , Oir} among a set of players V = 
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{Pi, P2, ■ ■ ■ J Pn} is inflatable if n can he increased for fixed number of q-players to form a new QSS(T' ) such that 
T'\-p — T, where F'j-p denotes the restriction ofV to V . 

Clearly, inflation involves the addition of classical information carrying c-players. The additional shares required for 
them will be c-shares, so that q-shares may remain fixed at m. The following theorem answers the question when a 
QSS scheme can be inflated. 

Theorem 1 A QSS scheme realizing an access structure T — {ai, a2, ■ ' ' iQ^r} among a set of players V — 
{Pi, P2, • • • , Pn} can always be inflated. 

Proof. Consider the addition of m new players, P„+i, • • • P,i+m, where m > 1. The new set of all players are 
V' = {Pi, P2, • • • , Pn+m}- A new access structure V = {a'l, • • • , a^} can be obtained by arbitrarily adding the new 
players to any of the a^'s. Clearly, V will not violate the no-cloning theorem, since F does not. The secret \S) is 
encrypted using classical string K to obtain \S). This encrypted secret is split-shared according to the original scheme 
implementing F, while K is split-shared among all n -I- to players according to the classical scheme implementing F'. 
To reconstruct the secret, members of any a'^ combine the q-shares of aj C a'^ to reconstruct |S'), and the c-shares 

with all members of a'^ to reconstruct K, using which the encrypted secret \S) is decrypted to \S). The new scheme 
is such that F = F'jp and V — V are c-players. Therefore, the new scheme QSS(F') is an inflation of the given scheme 
QSS(F). □ 

The above theorem only says that that any QSS scheme can be inflated in some way. A specific problem is whether 
a given (k, n)-QTS can be inflated to another QTS. This is considered in the following theorem and corollary. 

Theorem 2 A {k^n)-QTS can be inflated only conformally, ie., to threshold schemes having the form (fc -I- 7, rt -I- 7), 
where 7 (> 0) is an integer. 

Proof. If the given (/c, n)-QTS satisfies the no-cloning theorem, then cle arly so will the (fc + 7^, n 4- 7„)-QTS, where 
7fe > 7n > and k-\-^k < '^ + 7n- Further, according to Lemma 1 of Ref. (l8|, a restriction of the (fc-|-7fe, rt-|-7„)-QTS 
by 7 players necessarily yields a conformally reduced, (fc -I- 7fc — 7, n -I- 7„ — 7)-QTS. The restricted scheme has a 
different access structure from (fc,n)-QTS unless 7^ — 7„ ~ 7. Therefore, only a conformal inflation of (fc,7i)-QTS is 
possible, whereby it is inflated to a (/c -f 7, n -I- 7)-QTS by the addition of 7 c-players. □ 

In an implementation of Theorem 12 the quantum secret \S) is encrypted to \S) using a classical string K which is 
split-shared among all n-\-^ players according to a (A; -I- 7, rt -I- 7)-CTS. State \S) is then quantally split-shared among 
the n q-players according to a {k, n)-QTS. As a consequence of Theorem|21 we have the following negative result: 

Corollary 1 A {k,n)-QTS cannot be inflated at constant threshold. □ 



V. TWIN-THRESHOLD QUANTUM SECRET SHARING SCHEMES 

In a conventional or compressed (/c,n)-QTS, the threshold k applies to all members taken together. Now suppose 
that we have separate thresholds for c-membcrs and q-members, namely kc and kq, with k = kc+kq. We now extend the 
definition of a conventional QTS to a {kc,kq,n) quantum twin-threshold scheme (Q2TS) and a {kc, kq,n,<C) quantum 
twin-threshold scheme with common set (Q2TS-)-C), where a quantum secret \S) is split into n pieces (shares) according 
to some pre-agreed procedure and distributed among n players. These n share-holders consist of members of set Q of 
q-players and set Q of c-players. We denote q= \Q\, so that |Q| = n — q. Obviously, in a quantum scheme, Q 7^ 0. 

Definition 3 A QSS scheme is a {kc, kq, n) quantum twin-threshold scheme ( Q2TS) among n players, of which q are 
q-players and the remaining are c-players, if at least kc c-players and at least kq q-players are necessary to reconstruct 
the secret. 

Definition 4 A QSS scheme is a {kc, kq, n, C) quantum twin-threshold scheme with common set ( Q2TS+C) among n 
players, of which q are q-players and the remaining are c-players, if: (a) at least kc c-players and at least kq q-players 
are necessary to reconstruct the secret; (b) All members of the set C are necessary to reconstruct the secret. 

The idea behind distinguishing between the classical threshold kc and the quantum threshold kq is to obtain a 
simple generalization that combines the properties of the CTS and QTS. Practically speaking, it is best to minimize 
kq, at fixed k. However, one can in principle consider situations of potential use for a twin-threshold scheme, when 
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a sufSciently large number of members are able to process quantum information safely. Further, some of the share- 
holders, while not entirely trust- worthy, may yet be more trust-worthy than others. The share-dealer (say Alice) may 
prefer to include all such share-holders during any reconstruction of the secret. This is the requirement that motivates 
the introduction of set C. In general, C can contain members drawn from Q and/or Q or may be a null set. By 
definition, Q2TS+C with C = is Q2TS. 

In the following sections we present two methods to realize in varying degrees the generalized quantum secret 
splitting scheme. The first of these is the general version of Q2TS-I-C. The second, while more restricted, is interesting 
because it is not directly based on quantum erasure correction, but on information dilution via homogenization, in 
contrast to current proposals of QSS. 



A. Quantum error correction and quantum encryption 



We now give protocols that realizes the twin-threshold scheme based on quantum encryption. 
Scheme 1. Protocol to realize (fee, fcg, n)-Q2TS. 

Distribution phase. (1) Choose a random classical encryption K. Encrypt the quantum secret \S) using the 
encryption algorithm described in Section The encrypted state is denoted \S)\ (2) Using a conventional {kq,q)- 
QTS, split-share \S) among the members of Q; to not violate no-cloning, q should satisfy kq > {q/2); (3) Using a 
{kc,n — q)-CTS, split-share K among the members of Q. 

Reconstruction phase. (1) Collect any kg q-shares from members of Q and reconstruct \S); (2) Collect any k^ shares 
from members of Q and reconstruct K; (3) Reconstruct \S) using \S) and K. 

Now consider the case C 7^ and the Q2TS scheme becomes the more general Q2TS-I-C scheme. We now give a 
protocol that realizes this more general twin-threshold scheme. We denote Ag = |Q n C| and Ac = |Q n C|. Clearly, 
Ac + Aq = |C|. If there are no q-players in C, set A, = 0, and if there are no c-players in C, set Ac = 0. Note that by 
definition, q-players may also carry classical information, but c-players don't carry quantum information. 

Scheme 2. Protocol to realize (fee, kg, n, C)-Q2TS-|-C. 

Distribution phase. (1) Choose a random classical encryption K. Encrypt the quantum secret 15*) using the 
encryption algorithm described in Section|lJ The encrypted state is denoted \S); (2) Using a (2,2)-QTS, divide \S) 
into two pieces, say |S^i) and |S^2); (3) Using a (Aq,Ag)-QTS, split |5^i) among the q-members in C; (4) Using a 
conventional (kg — \q,q — Ag)-QTS, split |52) among the q-members not in C; to not violate no-cloning, q should 
satisfy {kq — Ag) > {q — Ag)/2; (5) Using a (2,2)-CTS, divide K into two shares, say Ki and K2\ (6) Part Ki is 
spht among the members of C using a (|C|, |C|)-CTS. Alternatively, it can be split using a (Ac, Ac)-CTS among the 
c-players in C; (7) Using a (fee — Ac, n — q — Ac)-CTS, split K2 among the members of Q — C. 

Reconstruction phase. (1) Collect all Ag shares from all members of Q fl C and reconstruct (2) Collect any 

kq — Ag q-shares from Q — C to reconstruct 152); (3) Combining l^i) and 15*2), reconstruct \S); (4) Collect all |C| 
c-shares from members of C and reconstruct Ki . Alternatively, collect all Ac c-shares from members of Q fl C and 
reconstruct if 1; (5) Collect any kc — Ac shares from Q — C and reconstruct K2; (6) Combining Ki and K2, reconstruct 
K. (7) Reconstruct \S) using \S) and K. 



B. Quantum twin-threshold scheme based on information dilution via homogenization 

The second, more restrictive scheme, is based on the procedure for information dilution in a system-reservoir 
interaction, proposed by Ziman et al. [23 • The novelty of the scheme lies in the fact that it is not directly based on 
an quantum error-correction code. However, it is applicable only to QSS with C ^ 0. Ref. |27| present a universal 
quantum homogenizer, a machine that takes as input a system qubit initially in the state p and a set of N reservoir 
qubits initially prepared in the identical state ^. In the homogenizer the system qubit sequentially interacts with the 
reservoir qubits via the partial swap operation so that the initial state p'g' of the system, after interacting with the 
N reservoir qubits, becomes: 

= Tr« [f/^ . . . U,{pf ® e^'Wl •••[/;] (3) 

where Uk = U® {®j^k^j) describes the interaction between the fcth qubit of the reservoir and the system qubit. The 
homogenizer realizes, in the limit sense, the transformation such that at the output each qubit is in an arbitrarily 
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small neighborhood of the state f irrespective of the initial states of the system and the reservoir qubits. Formally, 

D{pi''\0<S, VN>Ns, (4a) 
D{ek,0<S, Vl<fc<7V, (4b) 

where £)(•, •) denotes some distance (eg., a trace norm) between the states, (5 > is a small parameter chosen a priori 

The interaction between a reservoir qubit and the system qubit is given by the partial swap operation P(r]) = 
(cos ri)I + z(sin r])S, where S, the swap operator acting on the state of two qubits is defined by Sl-ip) = ^\ip). 
It can be shown that 77 can be chosen to enforce Eq. H4a|l according to the relation: 

sinry<V^- (5) 

Thus the information contained in the unknown system state is distributed in the correlations amongst the system 
and the reservoir qubits, whose marginal states are close to ^. As the authors point out, this process can be used as 
a quantum safe with a classical combination. 

Now we show how this particular feature can be turned into a special case of the {kc,kq,n,C) threshold scheme, 
subject to the restriction that Q C C, so that kg = q, i.e. all q-players must be present to reconstruct the secret. The 
homogenization is reversible and the original state of the system and the reservoir qubits can be unwound. Perfect 
unwinding can be performed only when the system particle is correctly identified from among the 7V + 1 output qubits, 
and it and the reservoir qubits interact via the inverse of the original partial swap operation. Therefore, in order to 
unwind the homogenized system, the classical information (denoted K) about the sequence of the qubit interactions 
is essential. Now, of the {N + 1)! possible orderings, only one will reverse the original process. The probability to 
choose the system qubit correctly is 1/(A^ + 1). Even when the particle is choosen successfully, there are still A^! 
different possibilities in choosing the sequence of interaction with the reservoir qubits. Thus, without the knowledge 
of the correct ordering, the probability of successfully unwinding the homogenization transformation is l/((-/V + 1)!), 
which is exponentially small in N. Moreover, a particular order of trial unwinding and measurement will irrecoverably 
destroy the system. This is demonstrated in Figures (4) and (5) of Ref. p^ . where various wrong permutations of the 
ordering, chosen by trial-and-error strategy, are shown not to reproduce the state. So, for sufficiently large value of 
iV, no information about the system qubit can be deduced without this classical information. Nevertheless, it is worth 
noting that the above computational argument, while rendering security of the homogenizing procedure intuitively 
understandable and highly plausible, does not rigorously prove it, even in the N 00 limit. 

A secondary wall of security is provided by the smallness oi S. It is useful if players already have knowledge of ^. In 
this case, because of conditions H4a(l . the homogenized state of the system or reservoir qubit cannot be distinguished 
from ^. 

If K is split up among the q members holding the system and reservoir qubits according to a (q, g)-CTS, it is 
easy to observe that this realizes a {q, g)-QTS not based directly on a quantum error-correction code. In terms of the 
generalized definition, this corresponds to a (fcc, kq, n, C)-scheme in which fee = 0, Q = C and n — kq = q. The classical 
layer of information sharing is necessary in order to strictly enforce the threshold: if prior ordering information were 
openly available, then for example the last q—1 participants could collude to obtain a state close to p. We now present 
the most general twin-threshold scheme possible based on homogenization. It will still be more restricted than that 
obtained via quantum encryption, requiring that Q C C, so that kq — q. If n is not too large, it is preferable for 
prevention of partial information leakage to choose the number A^ of reservoir qubits such that N ^ n. The general 
protocol is executed recursively as follows. 

Scheme 3: Protocol to realize a restricted (/cc, fcg, C)-Q2TS+C, with kq = q < n: Alice takes A^ (^ 1) reservoir 
qubits, where A^ -I- 1 = X^i"^* ^'^^ integers rrii >l(Vi:l<i<n), and performs the process of homogenization to 
obtain states Coj ■Cij • ' ' on the system qubit and the A^ reservoir qubits. 

Distribution phase: (1) Any rrii qubits from A^-f 1 qubits are given to the ith member of Q; (2) K is divided into two 
parts, Ki and according to a (2,2)-CTS; (3) Let Ac = |Q fl C| > 0. Ki is further split among the members of Q 
and Q n C using a ((7-|-Ac,(Z-|-Ac)-CTS; (4) K2 is split among the members of Q — C using a (fee — Ac,n — g — Ac)-CTS. 

Reconstruction phase: (1) Collect all q-shares from members of Q; (2) Collect all |C| c-shares from members of C 
and reconstruct Ki\ (3) Collect any kc — Ac shares from members of Q — C to reconstruct K2] (4) Using Ki and Ar2, 
reconstruct AT; (5) Using the q-shares and AT, unwind the system state to restore the secret \S). 
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